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UK Finance is the collective voice for the banking and finance industry. 


Representing more than 250 firms across the industry, we act to enhance competitiveness, support 
customers and facilitate innovation. 


Introductory comments — the context of online financial services 


1. The draft code appears to be focused on social media and similar online services. 
Providers of such services typically are relatively free to customise services and data 
collection for different customers and different business interests. 

2. In contrast, financial services products in scope — primarily online and mobile banking — 
operate in a much more tightly controlled environment. Financial services firms are subject 
to extensive regulation from the Financial Conduct Authority, governing interactions with 
customers to ensure fair treatment, transparency, detection and prevention of crime, 
support for vulnerable customers, responsible lending, etc. 

3. The content and timing of information provided to customers is heavily regulated. FCA also 
sets detailed rules requiring firms to have rigorous governance and risk management 
frameworks to ensure their compliance and good practice. 

4. When a financial services firm designs or updates an online service, it must therefore 
consider all of these interacting regulatory requirements. Any changes for the purposes of 
seeking to comply with the final Age Appropriate Design Code will need to be made in this 
wider regulatory context and ensure all obligations are met. 

5. The interacting (and constantly evolving) regulatory requirements create complexity in the 
design and implementation of online services by financial services firms. 

6. Our members take seriously the necessity to ensure protection of children online and will 
work to implement the final Code. Indeed, under financial sector regulation, they already 
have many obligations to protect customers’ interests, including children. However, as a 
consequence of the above: 

a. We should highlight that the degree of customisation and optionality envisaged by 
the Code will not always be possible, as much data processing and communications 
content is either required or restricted by other regulatory requirements. 

b. Implementation will be a complex task. Rather than 3 months, we consider that 18 
months could be necessary to ensure that the Code is effectively and fully 
implemented while also meeting other regulatory and legal requirements. 


Please find attached our response to the detailed ICO questions on the draft Code. 
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